Privacy Policy

I. General Provisions

1. The controller of personal data within the meaning of Article 4(7) of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the “GDPR”) is U Rozvařilů s.r.o., Company ID No.: 23791446, with its registered office at Sadová 470/14, Ruzyně, 161 00 Prague, Czech Republic (the “Controller”).
2. The Controller’s contact details:
   • Address: Sadová 470/14, Ruzyně, 161 00 Prague, Czech Republic
   • Email: info@jidelnaurozvarilu.cz
   • Phone: +420 773 528 528
3. Personal data means any information relating to an identified or identifiable natural person.
4. The Controller has appointed a Data Protection Officer. The Data Protection Officer’s contact details are: Lenka Mayerová, info@jidelnaurozvarilu.cz.

II. Sources and Categories of Personal Data

1. The Controller processes personal data that you provide when placing an order or communicating with us, as well as data generated in connection with processing your order and performing the contract.
2. This includes, in particular, identification and contact details, order and payment information, and other data necessary to perform the contract. The scope of processing reflects the purpose and nature of the service provided.

III. Purposes and Legal Bases for Processing Personal Data

1. Processing orders and performing contracts. We process personal data to receive and fulfil your order, communicate with you and perform the contract, or take steps at your request before entering into a contract. The legal basis is Article 6(1)(b) GDPR. Providing the data marked as mandatory is necessary to process your order; without it, we may be unable to enter into or perform the contract.
2. Compliance with legal obligations. We also process personal data to the extent necessary to comply with legal obligations, particularly those relating to accounting and taxation. The legal basis is Article 6(1)(c) GDPR.
3. Protection of legal claims. We may process necessary data to establish, exercise or defend legal claims. The legal basis is our legitimate interest in protecting our rights under Article 6(1)(f) GDPR.
4. Marketing communications to existing customers. If we obtained your electronic contact details in connection with the sale of a product or service, we may use them to send marketing communications about our own similar products or services, subject to Section 7(3) of Czech Act No. 480/2004 Coll., on Certain Information Society Services. The legal basis for processing is our legitimate interest under Article 6(1)(f) GDPR. You can opt out easily and free of charge when we collect your contact details and in every subsequent marketing communication.
5. Consent-based marketing. Where the existing-customer exception described above does not apply, we send electronic marketing communications only with your prior consent under Section 7(2) of Czech Act No. 480/2004 Coll. The legal basis for processing personal data is Article 6(1)(a) GDPR. Consent is voluntary and may be withdrawn at any time.
6. The Controller does not carry out automated individual decision-making within the meaning of Article 22 GDPR.

IV. Retention of Personal Data

We retain personal data only for as long as necessary for the relevant purpose:

• Data needed to process orders and perform contracts is retained while the order is being processed and for the duration of the contractual relationship.
• Data contained in records subject to statutory retention requirements is retained for the periods required by applicable law.
• Data necessary to protect legal claims is retained for the relevant limitation periods and, where applicable, for the duration of any proceedings.
• Data used for consent-based marketing is retained until consent is withdrawn, but no longer than the period for which consent was given.
• Data used for direct marketing based on legitimate interests is retained until you object or opt out, but no longer than the relevant legitimate interest continues to exist.

Once the relevant retention period expires, we delete or anonymise the data unless another legal basis justifies its continued retention. We may retain a record of your marketing opt-out to the extent necessary to ensure that no further marketing communications are sent to you.

V. Recipients of Personal Data and International Transfers

1. To the extent necessary, personal data may be disclosed to the following categories of recipients, depending on the services used:
   • suppliers involved in delivering goods, providing services and processing payments,
   • providers of technical, hosting and other services supporting the Controller’s operations,
   • providers of accounting and related services,
   • providers of marketing and email distribution services,
   • public authorities where disclosure is required by law.
2. Where a recipient processes personal data on behalf of the Controller as a processor, the relationship is governed by a data processing agreement in accordance with Article 28 GDPR.

VI. Your Rights

Subject to the conditions set out in the GDPR, you have:

• the right to access your personal data under Article 15 GDPR,
• the right to have inaccurate data rectified and incomplete data completed under Article 16 GDPR,
• the right to erasure of personal data under Article 17 GDPR,
• the right to restriction of processing under Article 18 GDPR,
• the right to data portability under Article 20 GDPR,
• the right to object to processing based on legitimate interests under Article 21 GDPR,
• the right to withdraw consent at any time where processing is based on consent; withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

You may object to the processing of your personal data for direct marketing at any time. If you object, we will no longer process your data for that purpose.

You can exercise your rights using the contact details provided in Section I of this Policy. You can also withdraw your consent to marketing communications using the unsubscribe link in the relevant message.

If you believe that the processing of your personal data infringes applicable law, you have the right to lodge a complaint with the Czech Office for Personal Data Protection: uoou.gov.cz.

VII. Security of Personal Data

1. The Controller implements appropriate technical and organisational measures reflecting the nature of the processing and the risks to individuals’ rights and freedoms.
2. These measures include protecting electronic storage systems and paper records against unauthorised access, loss, destruction or misuse.
3. Access to personal data is restricted to authorised persons to the extent necessary to perform their duties.

VIII. Final Provisions

1. This Policy provides information about the processing of personal data. Placing an order or acknowledging that you have read this Policy does not in itself constitute consent to processing personal data for marketing or other purposes requiring consent.
2. Processing necessary to perform a contract or comply with legal obligations is not conditional on your consent. Where consent is required, the Controller obtains it separately for a specific purpose.
3. The Controller may update this Policy. The current version will be published on the Controller’s website, and you will be informed of material changes in an appropriate manner where necessary.

This Policy takes effect on 1 December 2025.